Knowledge Management

Troubles in the Summary Index. Error message of "malformed search" pops up

kanj
New Member

I am having the same error message "This saved search cannot perform summary indexing because it has a malformed search" while setting up the summary index.
- The search with lookup and macros runs perfectly and provides results.
- My lookups and macros in the search are set within permissions.
What else do I need to set/edit for Summary indexing?

Labels (1)
0 Karma

anmolpatel
Builder

Go to inspect job and review the search.log to begin with.

If you could share the spl, that would be helpful

0 Karma
Get Updates on the Splunk Community!

New This Month in Splunk Observability Cloud - Metrics Usage Analytics, Enhanced K8s ...

The latest enhancements across the Splunk Observability portfolio deliver greater flexibility, better data and ...

Alerting Best Practices: How to Create Good Detectors

At their best, detectors and the alerts they trigger notify teams when applications aren’t performing as ...

Discover Powerful New Features in Splunk Cloud Platform: Enhanced Analytics, ...

Hey Splunky people! We are excited to share the latest updates in Splunk Cloud Platform 9.3.2408. In this ...